IDSM-2 vs Netsky.aa

Question

Hello! My IDSM-2 (ver. 5.0.5 with latest signature updates) on Cat6513 (CatOS) doesn't catch Netsky.aa virus, while my antivirus software does... Why? How I can drop the Netsky.aa activity with IDSM?
Thanks in advance.

Answer 1

Seeing as we partner with TrendMicro for virus and malware, we also happen to use their naming convention. I was able to cross reference some of the list you submitted, coverage as noted below.
That said, the IDS/IPS is a network intrusion sensor, not an antivirus solution. We provide coverage for viris/worms/malware that are fast breaking and pose significant risk to the end customer, but we do not cover every threat out there. For virus/worms/malware that are elevated to a High severity on TrendMicro's site, you'll see a signature on the IDS platform for it.
To my knowledge, there are no plans to incorporate anti-spam filtering on the IDS/IPS platforms at this time. Frankly, it doesn't make much sense to me to have your IDS filter for spam, but that's just my opinion.
Email-Worm.Win32.NetSky.q
3136-5 Netsky.Q pif
Email-Worm.Win32.Sober.y
Is known as WORM_SOBER.AG to TrendMicro and is covered by signature 3137-6
Email-Worm.Win32.Bagle.dx
Is known as WORM_BAGLE.BM to TrendMicro, rated as low, no signature.
Email-Worm.Win32.NetSky.b
We don not cover the B variant, but do cover the following: c,d,e,k,j,p,q,s,x,y,ab,z
Did a quick search on Trend's site, but didn't find a match to these:
Email-Worm.Win32.Doombot.b
Net-Worm.Win32.Mytob.q
Net-Worm.Win32.Mytob.c
Net-Worm.Win32.Bobic.k
Email-Worm.Win32.Bagle.gen
Email-Worm.Win32.Bagle.bw